Privilege Reference - Authentication
Privilege Reference
These privileges can be set on the AppToken (sessionPrivileges) or passed at startSession time.
Access Control Privileges
| Privilege | Description |
|---|---|
sview:* | View/play all entries |
sview:<entryId> | View/play a specific entry only |
list:* | List entries across all owners |
edit:* | Edit any entry |
edit:<entryId> | Edit a specific entry only |
download:<entryId> | Download a specific entry |
enableentitlement | Enable entitlement checks |
disableentitlement | Disable entitlement checks (limit to admin-only backend operations) |
privacycontext:<label> | Scope to a specific privacy context |
Session Control Privileges
| Privilege | Description |
|---|---|
setrole:<roleId> | Restrict to a specific user role |
actionslimit:<N> | Max number of API calls this session can make |
iprestrict:<IP> | Restrict session to a specific IP address |
urirestrict:<path> | Restrict session to specific API paths |
sessionid:<GUID> | Group sessions for bulk revocation |
appId:<name-domain> | Tag session for analytics tracking |
Common Privilege Sets
# Read-only playback (with entitlements)
sview:*,enableentitlement,privacycontext:MY_PORTAL
# Upload integration (scoped to user's own content)
edit:*,sview:*
# Single-entry playback ticket
sview:1_abc123,setrole:PLAYBACK_BASE_ROLE,actionslimit:10
# Analytics-tagged integration
sview:*,list:*,appId:my-app-example.com